docs: clarify keychain token precedence

Agent-Logs-Url: https://github.com/CakeRepository/1Password-MCP/sessions/4c5b132a-69be-40e9-ad6d-742b25bca276

Co-authored-by: CakeRepository <27045642+CakeRepository@users.noreply.github.com>

Author: Copilot

README.md

@@ -87,7 +87,7 @@ If you do not want to store the service account token directly in your MCP confi
 }
 ```
 
-`OP_SERVICE_ACCOUNT_TOKEN` still takes precedence when set. `OP_KEYCHAIN_ACCOUNT` is optional if your Keychain service name is already unique enough.
+Precedence is: CLI arguments (`--service-account-token` / `--token`) > `OP_SERVICE_ACCOUNT_TOKEN` > macOS Keychain lookup. `OP_KEYCHAIN_ACCOUNT` is optional if your Keychain service name is already unique enough.
 
 ### OpenAI Codex (TOML)
 

src/config.ts

@@ -80,13 +80,13 @@ export function resolveServiceAccountToken({
   }) => string | undefined;
 } = {}): Pick<ServerConfig, "serviceAccountToken" | "tokenSource"> {
   const tokenFromEnv = env.OP_SERVICE_ACCOUNT_TOKEN;
-  const tokenFromKeychain =
-    tokenFromArgs || tokenFromEnv
-      ? undefined
-      : readKeychainToken({
-          service: env.OP_KEYCHAIN_SERVICE,
-          account: env.OP_KEYCHAIN_ACCOUNT,
-        });
+  let tokenFromKeychain: string | undefined;
+  if (!tokenFromArgs && !tokenFromEnv) {
+    tokenFromKeychain = readKeychainToken({
+      service: env.OP_KEYCHAIN_SERVICE,
+      account: env.OP_KEYCHAIN_ACCOUNT,
+    });
+  }
 
   const serviceAccountToken = tokenFromArgs ?? tokenFromEnv ?? tokenFromKeychain;